@computesdk/cli 1.0.10 → 1.0.12

package/dist/index.js

@@ -587,7 +587,7 @@ import "dotenv/config";
 import { Command } from "commander";
 import * as p4 from "@clack/prompts";
 import pc6 from "picocolors";
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname2, join as join5 } from "path";
 import { compute as compute4 } from "computesdk";
@@ -694,7 +694,7 @@ function buildProviderConfig(provider) {
 // src/actions.ts
 init_esm_shims();
 import pc from "picocolors";
-import { mkdirSync, writeFileSync } from "fs";
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
 import { basename, join } from "path";
 
 // src/actions-client.ts
@@ -708,6 +708,76 @@ var ActionsApiError = class extends Error {
     this.name = "ActionsApiError";
   }
 };
+var ActionsCliError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ActionsCliError";
+  }
+};
+function codeForStatus(status) {
+  switch (status) {
+    case 400:
+      return "bad_request";
+    case 401:
+      return "unauthenticated";
+    case 403:
+      return "forbidden";
+    case 404:
+      return "not_found";
+    case 409:
+      return "conflict";
+    case 413:
+      return "payload_too_large";
+    case 429:
+      return "rate_limited";
+    default:
+      return status >= 500 ? "server_error" : "http_error";
+  }
+}
+function errorDetails(body) {
+  if (body && typeof body === "object" && "details" in body) {
+    const details = body.details;
+    if (details && typeof details === "object" && !Array.isArray(details)) {
+      return details;
+    }
+  }
+  return void 0;
+}
+function toErrorEnvelope(error) {
+  if (error instanceof ActionsApiError) {
+    const details = errorDetails(error.body);
+    return {
+      ok: false,
+      error: {
+        code: codeForStatus(error.status),
+        message: error.message,
+        httpStatus: error.status,
+        retryable: error.status === 429 || error.status === 502 || error.status === 503 || error.status === 504,
+        ...details !== void 0 && { details }
+      }
+    };
+  }
+  if (error instanceof ActionsCliError) {
+    return { ok: false, error: { code: error.code, message: error.message, retryable: false } };
+  }
+  if (error instanceof TypeError && /fetch failed/i.test(error.message)) {
+    const cause = error.cause;
+    const detail = cause instanceof Error ? `: ${cause.message}` : "";
+    return {
+      ok: false,
+      error: { code: "network", message: `${error.message}${detail}`, retryable: true }
+    };
+  }
+  return {
+    ok: false,
+    error: {
+      code: "unknown",
+      message: error instanceof Error ? error.message : String(error),
+      retryable: false
+    }
+  };
+}
 var ActionsClient = class {
   constructor(auth, fetchImpl = fetch) {
     this.auth = auth;
@@ -747,6 +817,14 @@ var ActionsClient = class {
     });
     return this.parse(res);
   }
+  async patch(path5, body = {}) {
+    const res = await this.fetchImpl(`${this.auth.baseUrl}${path5}`, {
+      method: "PATCH",
+      headers: { ...this.headers(), "content-type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    return this.parse(res);
+  }
   async del(path5) {
     const res = await this.fetchImpl(`${this.auth.baseUrl}${path5}`, {
       method: "DELETE",
@@ -826,22 +904,64 @@ function encodeWatchCursor(id, jobId, step, offset) {
   const stepPart = step === null ? "-" : step === "runner" ? "runner" : String(step);
   return `${id}:${jobId}:${stepPart}:${offset}`;
 }
-function resolveActionsAuth(opts) {
-  const apiKey = opts.apiKey || process.env.COMPUTE_API_KEY || process.env.BENCHMARKS_PLATFORM_API_KEY;
-  if (!apiKey) {
-    throw new Error(
-      "No API key. Set COMPUTE_API_KEY or pass --api-key."
-    );
-  }
+var NO_CREDENTIALS_HINT = "Set COMPUTE_API_KEY, pass --api-key, or run `compute bench auth login`.";
+async function resolveActionsAuth(opts, resolveStored = resolveStoredPlatformAuth) {
   const baseUrl = (opts.baseUrl || process.env.COMPUTE_PLATFORM_URL || process.env.BENCHMARKS_PLATFORM_URL || // legacy name
   DEFAULT_BASE_URL).replace(/\/+$/, "");
   if (!opts.allowUntrustedHost && !isTrustedActionsHost(baseUrl)) {
-    throw new Error(
+    throw new ActionsCliError(
+      "untrusted_host",
       `Refusing to send the API key to ${baseUrl} \u2014 it is not a computesdk.com or localhost host. If this is a self-hosted/dev deployment you trust, pass --allow-untrusted-host.`
     );
   }
+  if (!isSecureActionsTransport(baseUrl)) {
+    throw new ActionsCliError(
+      "insecure_transport",
+      `Refusing to send the API key over plaintext HTTP to ${baseUrl}. Use an https:// base URL; http:// is only allowed for localhost/loopback.`
+    );
+  }
+  let apiKey = opts.apiKey || process.env.COMPUTE_API_KEY || process.env.BENCHMARKS_PLATFORM_API_KEY || // legacy name
+  void 0;
+  if (!apiKey) {
+    if (!isTrustedActionsHost(baseUrl)) {
+      throw new ActionsCliError(
+        "untrusted_host_stored_auth",
+        `Refusing to use stored platform credentials with untrusted host ${baseUrl}. Pass --api-key or set COMPUTE_API_KEY to use an explicit key with --allow-untrusted-host.`
+      );
+    }
+    let stored;
+    try {
+      stored = await resolveStored({ baseUrl });
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      const detail = reason.startsWith("No credentials found") ? "No API key." : reason;
+      throw new ActionsCliError("no_credentials", `${detail} ${NO_CREDENTIALS_HINT}`);
+    }
+    apiKey = stored.apiKey || stored.token || void 0;
+  }
+  if (!apiKey) {
+    throw new ActionsCliError("no_credentials", `No API key. ${NO_CREDENTIALS_HINT}`);
+  }
   return { apiKey, baseUrl };
 }
+async function resolveStoredPlatformAuth(opts) {
+  const { resolveAuth } = await import("@benchsdk/cli");
+  const auth = await resolveAuth({ baseUrl: opts.baseUrl });
+  return { apiKey: auth.apiKey, token: auth.token };
+}
+function isLoopbackHost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
+}
+function isSecureActionsTransport(baseUrl) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    return false;
+  }
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && isLoopbackHost(url.hostname);
+}
 function isTrustedActionsHost(baseUrl) {
   let host;
   try {
@@ -849,7 +969,7 @@ function isTrustedActionsHost(baseUrl) {
   } catch {
     return false;
   }
-  return host === "computesdk.com" || host.endsWith(".computesdk.com") || host === "localhost" || host === "127.0.0.1" || host === "::1";
+  return host === "computesdk.com" || host.endsWith(".computesdk.com") || isLoopbackHost(host);
 }
 
 // src/actions.ts
@@ -858,8 +978,8 @@ function sanitizePathPart(name) {
   if (base === "" || base === "." || base === "..") return "artifact";
   return base;
 }
-function client(opts) {
-  return new ActionsClient(resolveActionsAuth(opts));
+async function client(opts) {
+  return new ActionsClient(await resolveActionsAuth(opts));
 }
 function output(opts, data, render) {
   if (opts.json) {
@@ -892,14 +1012,36 @@ async function listRunJobs(c, runId) {
     steps: []
   }));
 }
-function fail(error) {
-  if (error instanceof ActionsApiError) {
+async function fetchRunSummary(c, runId) {
+  try {
+    return await c.get(`/api/v1/actions/runs/${runId}/summary`);
+  } catch (e) {
+    if (!(e instanceof ActionsApiError && e.status === 404)) {
+      console.error(
+        pc.dim(`summary unavailable: ${e instanceof Error ? e.message : String(e)}`)
+      );
+    }
+    return null;
+  }
+}
+function fail(error, opts = {}) {
+  if (opts.json) {
+    process.stderr.write(JSON.stringify(toErrorEnvelope(error)) + "\n");
+  } else if (error instanceof ActionsApiError) {
     console.error(pc.red(`Error (${error.status}): ${error.message}`));
   } else {
-    console.error(pc.red(`Error: ${error.message}`));
+    console.error(pc.red(`Error: ${error instanceof Error ? error.message : String(error)}`));
   }
   process.exit(1);
 }
+function usageErrorOutput(str, write, argv = process.argv) {
+  if (argv.includes("--json")) {
+    const message = str.replace(/^error:\s*/i, "").trim();
+    write(JSON.stringify(toErrorEnvelope(new ActionsCliError("invalid_argument", message))) + "\n");
+  } else {
+    write(str);
+  }
+}
 function formatDuration(ms) {
   if (ms === null || ms === void 0) return "-";
   if (ms < 1e3) return `${ms}ms`;
@@ -970,12 +1112,102 @@ function formatRunDetail(run, runUrl) {
   }
   return lines.join("\n");
 }
+function formatRunInspection(run) {
+  const lines = [];
+  lines.push(`${pc.bold("run")}  ${conclusionLabel(run.conclusion)}${run.runNumber === null ? "" : `  #${run.runNumber}`}`);
+  lines.push(pc.dim(run.id));
+  lines.push(`${safeTerm(run.ref)}  ${shortSha(run.headSha)}  ${safeTerm(run.event)}`);
+  lines.push(`queued: ${run.queuedAt}  started: ${run.startedAt}  finished: ${run.finishedAt}`);
+  if (run.cancellationReason) lines.push(`cancelled: ${run.cancellationReason}`);
+  if (run.supersededByRunId) lines.push(`superseded by: ${run.supersededByRunId}`);
+  if (run.blockedReason) lines.push(pc.red(`blocked: ${safeTerm(run.blockedReason)}`));
+  if (run.concurrencyGroup) lines.push(`concurrency: ${safeTerm(run.concurrencyGroup)}`);
+  if (run.providerOverride) lines.push(`dispatched to: ${safeTerm(run.providerOverride)}`);
+  if (run.definitionStale) {
+    const parsed = run.workflowParsedFromSha ? shortSha(run.workflowParsedFromSha) : "unknown";
+    lines.push(pc.yellow(`definition: stored parse is from ${parsed}, not this head \u2014 context may be newer than the run`));
+  }
+  if (run.dispatchInputs && Object.keys(run.dispatchInputs).length > 0) {
+    lines.push(`inputs: ${Object.entries(run.dispatchInputs).map(([k, v]) => `${safeTerm(k)}=${safeTerm(v)}`).join("  ")}`);
+  }
+  if (run.secrets) {
+    const names = run.secrets.names.length > 0 ? run.secrets.names.map(safeTerm).join(", ") : "none";
+    lines.push(`secrets (${run.secrets.access}${run.secrets.env ? ", exported to env" : ""}): ${names}`);
+  }
+  if (run.caches.length > 0) {
+    lines.push("");
+    lines.push(pc.bold("caches"));
+    for (const cache of run.caches) {
+      const action = [cache.restoredAt ? "restored" : null, cache.savedAt ? "saved" : null].filter(Boolean).join("+");
+      lines.push(`  ${safeTerm(cache.key)}  ${pc.dim(`${action}  ${safeTerm(cache.scopeRef)}  ${cache.sizeBytes}B`)}`);
+    }
+  }
+  if (run.jobs.length > 0) {
+    lines.push("");
+    lines.push(pc.bold("jobs"));
+    for (const job of run.jobs) {
+      const placement = job.provider ? `${safeTerm(job.provider)}${job.region ? `:${safeTerm(job.region)}` : ""}` : "-";
+      lines.push(`  ${safeTerm(job.name)}  ${conclusionLabel(job.state)}  ${placement}`);
+      lines.push(pc.dim(`    ${job.id}`));
+      if (job.runsOn.length > 0 || job.resolvedRunsOn !== null) {
+        const resolved = job.resolvedRunsOn !== null && job.resolvedRunsOn.join(",") !== job.runsOn.join(",") ? ` \u2192 ${job.resolvedRunsOn.map(safeTerm).join(", ")}` : "";
+        lines.push(`    runs-on: ${job.runsOn.map(safeTerm).join(", ") || "(none)"}${resolved}`);
+      }
+      if (job.runsOnHasExpression) lines.push(pc.dim("    runs-on resolves at runtime (expression)"));
+      if (job.container) lines.push(`    container: ${safeTerm(job.container)}`);
+      if (job.runnerImage) lines.push(`    image: ${safeTerm(job.runnerImage)}`);
+      if (job.placementHint) {
+        lines.push(`    pinned: ${safeTerm(job.placementHint.label)}`);
+      }
+      if (job.concurrencyGroup) {
+        lines.push(`    concurrency: ${safeTerm(job.concurrencyGroup)}${job.concurrencyCancelInProgress ? " (cancel-in-progress)" : ""}`);
+      }
+      const overrides = [
+        job.timeoutMinutes !== null ? `timeout ${job.timeoutMinutes}m` : null,
+        job.fetchDepth !== null ? `fetch-depth ${job.fetchDepth}` : null
+      ].filter(Boolean);
+      if (overrides.length > 0) lines.push(`    ${overrides.join("  ")}`);
+      if (job.matrix) {
+        lines.push(`    matrix: ${Object.entries(job.matrix).map(([k, v]) => `${safeTerm(k)}=${safeTerm(v)}`).join(" ")}`);
+      }
+      if (job.failureReason) lines.push(pc.red(`    failed: ${safeTerm(job.failureReason)}`));
+      for (const attempt of job.placementAttempts) {
+        lines.push(pc.dim(`    placement failed on ${safeTerm(attempt.provider)}${attempt.region ? `:${safeTerm(attempt.region)}` : ""}: ${safeTerm(attempt.error)}`));
+      }
+    }
+  }
+  return lines.join("\n");
+}
+function formatRunSummary(summary) {
+  const lines = [];
+  lines.push(pc.bold(`failures \u2014 run ${summary.runId} ${conclusionLabel(summary.conclusion)}`));
+  if (summary.failures.length === 0) {
+    lines.push("  no failed jobs");
+    return lines.join("\n");
+  }
+  for (const job of summary.failures) {
+    const placement = job.provider ? `${safeTerm(job.provider)}${job.region ? `:${safeTerm(job.region)}` : ""}` : "-";
+    lines.push(`  ${job.id}  ${safeTerm(job.name)}  ${conclusionLabel(job.conclusion)}  ${placement}`);
+    if (job.failureReason) lines.push(pc.dim(`    ${safeTerm(job.failureReason)}`));
+    for (const step of job.failedSteps) {
+      const exit = step.exitCode === null ? "" : ` (exit ${step.exitCode})`;
+      lines.push(`    step ${step.ordinal}  ${safeTerm(step.name)}${exit}`);
+    }
+    if (job.excerpt) {
+      const scope = job.excerpt.stepOrdinal === null ? "job log" : `step ${job.excerpt.stepOrdinal}`;
+      const cut = job.excerpt.truncated ? ", truncated" : "";
+      lines.push(pc.dim(`    \u2500\u2500 ${scope} tail${cut} \u2500\u2500`));
+      for (const line of job.excerpt.text.split("\n")) lines.push(`    ${safeTerm(line)}`);
+    }
+  }
+  return lines.join("\n");
+}
 function parseInputs(pairs) {
   const inputs = {};
   for (const pair of pairs ?? []) {
     const eq = pair.indexOf("=");
     if (eq === -1) {
-      throw new Error(`Invalid --inputs entry "${pair}". Expected key=value.`);
+      throw new ActionsCliError("invalid_argument", `Invalid --inputs entry "${pair}". Expected key=value.`);
     }
     inputs[pair.slice(0, eq)] = pair.slice(eq + 1);
   }
@@ -1025,7 +1257,7 @@ function parseStep(step) {
   if (step === "runner") return "runner";
   const n = Number(step);
   if (!Number.isInteger(n) || n < 0) {
-    throw new Error(`Invalid --step "${step}". Expected a step ordinal or "runner".`);
+    throw new ActionsCliError("invalid_argument", `Invalid --step "${step}". Expected a step ordinal or "runner".`);
   }
   return n;
 }
@@ -1109,14 +1341,57 @@ function formatVerifyResult(r) {
   const act = r.key.actCapable ? pc.green("  act-capable") : "";
   return `${head}  ${r.key.provider}${act}${detail}`;
 }
+function formatRepoRow(r) {
+  const head = r.enabled ? pc.green("enabled") : pc.dim("disabled");
+  const via = r.authType === "github_app" ? "github-app" : r.authType;
+  const workflows = r.workflowPaths.length > 0 ? `${r.workflowPaths.length} workflow${r.workflowPaths.length === 1 ? "" : "s"}` : "no workflows yet";
+  const error = r.lastPollError ? pc.red(`  poll error: ${safeTerm(r.lastPollError)}`) : "";
+  return `${head}  ${safeTerm(r.fullName)}  ${pc.dim(`${safeTerm(via)} \xB7 ${safeTerm(r.defaultBranch)} \xB7 ${workflows}`)}${error}`;
+}
+function printDiscovery(d) {
+  if (d.error) {
+    console.log(pc.yellow(`discovery: ${safeTerm(d.error)} (the poll cron retries)`));
+    return;
+  }
+  console.log(pc.dim(`discovery: ${d.workflowsFound ? "workflows found" : "no workflows yet"}${d.seeded ? ", cursors seeded" : ""}`));
+}
+function dispatchBody(workflow, opts) {
+  if (!workflow.dispatchable && !opts.manual) {
+    throw new ActionsCliError(
+      "invalid_argument",
+      `Workflow "${workflow.path}" does not declare workflow_dispatch. Pass --manual to run it anyway (no inputs).`
+    );
+  }
+  if (!workflow.dispatchable && opts.inputs !== void 0 && opts.inputs.length > 0) {
+    throw new ActionsCliError(
+      "invalid_argument",
+      `Workflow "${workflow.path}" has no workflow_dispatch inputs; --manual runs of it take no --inputs.`
+    );
+  }
+  const ref = opts.ref ?? workflow.refs[0];
+  if (!ref) throw new ActionsCliError("invalid_argument", "No --ref given and the workflow has no watched refs.");
+  if (opts.providerRegion !== void 0 && opts.provider === void 0) {
+    throw new ActionsCliError("invalid_argument", "--provider-region requires --provider.");
+  }
+  return {
+    workflowId: workflow.id,
+    ref,
+    inputs: parseInputs(opts.inputs),
+    ...opts.manual && { manual: true },
+    ...opts.provider !== void 0 && {
+      provider: opts.provider,
+      ...opts.providerRegion !== void 0 && { providerRegion: opts.providerRegion }
+    }
+  };
+}
 function registerActionsCommands(program2) {
-  const actions = program2.command("actions").alias("ci").description("Drive the benchmarks-platform Actions API");
-  const common = (cmd) => cmd.option("--api-key <key>", "API key (default: $COMPUTE_API_KEY)").option("--base-url <url>", "API base URL (default: https://platform.computesdk.com)").option("--allow-untrusted-host", "send the API key to a non-computesdk, non-localhost --base-url").option("--json", "print machine-readable JSON");
+  const actions = program2.command("actions").alias("ci").description("Drive the benchmarks-platform Actions API").configureOutput({ outputError: usageErrorOutput });
+  const common = (cmd) => cmd.option("--api-key <key>", "API key (default: $COMPUTE_API_KEY)").option("--base-url <url>", "API base URL (default: https://platform.computesdk.com)").option("--allow-untrusted-host", "send an explicit --api-key/env key to a non-computesdk, non-localhost --base-url (stored login credentials are never sent)").option("--json", "print machine-readable JSON");
   common(
-    actions.command("dispatch").description("Dispatch a workflow_dispatch run").argument("<repo>", "repository in owner/repo format").requiredOption("--workflow <path|name>", "workflow path or name").option("--ref <ref>", "git ref to run (default: the workflow's first watched ref)").option("--inputs <pairs...>", "workflow inputs as key=value").option("--provider <id>", "place the run on one provider (e.g. namespace, vercel:sfo1) instead of the org provider order").option("--provider-region <region>", "region for --provider (same as --provider <id>:<region>)")
+    actions.command("dispatch").description("Dispatch a workflow_dispatch run (or any workflow with --manual)").argument("<repo>", "repository in owner/repo format").requiredOption("--workflow <path|name>", "workflow path or name").option("--ref <ref>", "git ref to run (default: the workflow's first watched ref)").option("--inputs <pairs...>", "workflow inputs as key=value (workflow_dispatch inputs only)").option("--manual", "run a workflow even if it does not declare workflow_dispatch (such runs take no --inputs)").option("--provider <id>", "place the run on one provider (e.g. namespace, vercel:sfo1) instead of the org provider order").option("--provider-region <region>", "region for --provider (same as --provider <id>:<region>)")
   ).action(async (repo, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       const { workflows } = await c.get(
         "/api/v1/actions/workflows",
         { repo }
@@ -1124,26 +1399,15 @@ function registerActionsCommands(program2) {
       const workflow = matchWorkflow(workflows, opts.workflow);
       if (!workflow) {
         const choices = workflows.map((w) => `${w.path} (${w.name})`).join(", ") || "none";
-        throw new Error(
-          `No dispatchable workflow "${opts.workflow}" in ${repo}. Available: ${choices}`
+        throw new ActionsCliError(
+          "workflow_not_found",
+          `No workflow "${opts.workflow}" in ${repo}. Available: ${choices}`
         );
       }
-      const ref = opts.ref ?? workflow.refs[0];
-      if (!ref) throw new Error("No --ref given and the workflow has no watched refs.");
-      if (opts.providerRegion !== void 0 && opts.provider === void 0) {
-        throw new Error("--provider-region requires --provider.");
-      }
+      const body = dispatchBody(workflow, opts);
       const result = await c.post(
         "/api/v1/actions/dispatch",
-        {
-          workflowId: workflow.id,
-          ref,
-          inputs: parseInputs(opts.inputs),
-          ...opts.provider !== void 0 && {
-            provider: opts.provider,
-            ...opts.providerRegion !== void 0 && { providerRegion: opts.providerRegion }
-          }
-        }
+        body
       );
       const org = await c.org();
       const url = `${c.baseUrl}/${org.slug}/actions/runs/${result.runId}`;
@@ -1153,14 +1417,14 @@ function registerActionsCommands(program2) {
         console.log(`url: ${r.url}`);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("runs").description("List recent runs for a repo").argument("<repo>", "repository in owner/repo format").option("--status <status...>", "filter by conclusion: passed, failed, running, cancelled, none").option("--branch <branch...>", "filter by branch/ref")
   ).action(async (repo, opts) => {
     try {
-      const { runs } = await client(opts).get(
+      const { runs } = await (await client(opts)).get(
         "/api/v1/actions/runs",
         { repo, status: opts.status, branch: opts.branch }
       );
@@ -1172,14 +1436,14 @@ function registerActionsCommands(program2) {
         for (const run of rs) console.log(formatRunRow(run));
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("history").description("Recent run history for a workflow \u2014 per-job/step failure rates (is this failure flaky?)").argument("<repo>", "repository in owner/repo format").requiredOption("--workflow <path|name>", "workflow path or name").option("--branch <branch...>", "narrow the window to branches/refs").option("--job <job>", "narrow the rollup to one job name or workflow job id").option("--limit <n>", "runs in the window (default 10, max 50)")
   ).action(async (repo, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       const { workflows } = await c.get(
         "/api/v1/actions/workflows",
         { repo }
@@ -1195,27 +1459,57 @@ function registerActionsCommands(program2) {
       });
       output(opts, history, (h) => console.log(formatRunHistory(h)));
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("run").description("Show a run: jobs, provider:region placement, placement attempts").argument("<run-id>", "run ID")
   ).action(async (runId, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       const run = await c.get(`/api/v1/actions/runs/${runId}`);
       const org = await c.org();
       const url = `${c.baseUrl}/${org.slug}/actions/runs/${run.id}`;
-      output(opts, { ...run, url }, (r) => console.log(formatRunDetail(r, r.url)));
+      const summary = run.conclusion === "failed" ? await fetchRunSummary(c, runId) : null;
+      output(opts, { ...run, url, summary }, (r) => {
+        console.log(formatRunDetail(r, r.url));
+        if (summary && summary.failures.length > 0) {
+          console.log("");
+          console.log(formatRunSummary(summary));
+        }
+      });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
+    }
+  });
+  common(
+    actions.command("summary").description("Show a run's failure digest: failed jobs, failed steps, bounded log tails").argument("<run-id>", "run ID")
+  ).action(async (runId, opts) => {
+    try {
+      const summary = await (await client(opts)).get(`/api/v1/actions/runs/${runId}/summary`);
+      output(opts, summary, (s) => console.log(formatRunSummary(s)));
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  common(
+    actions.command("inspect").description("Inspect a run: resolved runner image, caches, secret names, concurrency, placement context").argument("<run-id>", "run ID")
+  ).action(async (runId, opts) => {
+    try {
+      const c = await client(opts);
+      const inspection = await c.get(
+        `/api/v1/actions/runs/${runId}/state`
+      );
+      output(opts, inspection, (r) => console.log(formatRunInspection(r)));
+    } catch (e) {
+      fail(e, opts);
     }
   });
   common(
     actions.command("logs").description("Print or follow a run's job logs").argument("<run-id>", "run ID").option("--job <job>", "job ID or name (default: all jobs)").option("--step <step>", 'step ordinal or "runner" (default: whole job)').option("--follow", "stream logs while the run is live")
   ).action(async (runId, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       let jobs = await listRunJobs(c, runId);
       if (opts.job) {
         const job = matchJob(jobs, opts.job);
@@ -1266,25 +1560,25 @@ function registerActionsCommands(program2) {
         }
       }
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   const providers = actions.command("providers").description("List the org's registered compute providers (regions, act/usable status)");
   common(providers).action(async (opts) => {
     try {
-      const data = await client(opts).get("/api/v1/actions/providers");
+      const data = await (await client(opts)).get("/api/v1/actions/providers");
       output(opts, data, (d) => {
         for (const p5 of d.providers) console.log(formatProviderRow(p5));
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     providers.command("configure").description("Save the org's credential for a provider (owner/admin API key)").argument("<provider>", "provider id (e.g. tensorlake, blaxel)").option("--key <key>", "provider API key (single-field credentials)").option("--field <pair...>", "credential fields as name=value (multi-field providers)").option("--verify", "run the placement probe after saving")
   ).action(async (provider, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       let body;
       if (opts.field !== void 0) {
         if (opts.key !== void 0) throw new Error("Pass either --key or --field, not both.");
@@ -1307,55 +1601,138 @@ function registerActionsCommands(program2) {
       });
       if (verification?.verified === false) process.exitCode = 1;
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     providers.command("verify").description('Probe the stored provider key with a real sandbox ("Test" in Settings)').argument("<provider>", "provider id")
   ).action(async (provider, opts) => {
     try {
-      const result = await client(opts).post(
+      const result = await (await client(opts)).post(
         `/api/v1/actions/providers/${provider}/verify`
       );
       output(opts, result, (r) => console.log(formatVerifyResult(r)));
       if (result.verified === false) process.exitCode = 1;
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     providers.command("remove").description("Delete the org's stored credential for a provider").argument("<provider>", "provider id")
   ).action(async (provider, opts) => {
     try {
-      const result = await client(opts).del(
+      const result = await (await client(opts)).del(
         `/api/v1/actions/providers/${provider}/key`
       );
       output(opts, result, (r) => {
         console.log(r.deleted ? `deleted  ${r.provider}` : `no key stored for ${r.provider}`);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
+    }
+  });
+  const repos = actions.command("repos").description("List the org's connected repositories");
+  common(repos).action(async (opts) => {
+    try {
+      const data = await (await client(opts)).get("/api/v1/actions/repos");
+      output(opts, data, (d) => {
+        for (const r of d.repos) console.log(formatRepoRow(r));
+      });
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  common(
+    repos.command("connect").description("Connect a git remote (validated by a real ls-remote; lands enabled)").argument("<cloneUrl>", "http(s) or ssh git remote URL").option("--name <owner/repo>", "repo name override (default: derived from cloneUrl)").option("--branch <branch>", "default branch (default: main, else the remote's first)").option("--token <token>", "credential for private http(s) remotes").option("--username <user>", 'username \u2014 with --token, makes auth "basic" instead of "token"').option("--ssh-key-file <path>", "OpenSSH/PEM private key file for ssh remotes").option("--known-hosts-file <path>", "known_hosts pin for ssh remotes")
+  ).action(async (cloneUrl, opts) => {
+    try {
+      let body;
+      if (opts.sshKeyFile !== void 0) {
+        if (opts.token !== void 0 || opts.username !== void 0) {
+          throw new Error("Pass either --ssh-key-file or --token/--username, not both.");
+        }
+        body = {
+          authType: "ssh",
+          credential: readFileSync(opts.sshKeyFile, "utf8"),
+          ...opts.knownHostsFile !== void 0 && {
+            knownHosts: readFileSync(opts.knownHostsFile, "utf8")
+          }
+        };
+      } else if (opts.username !== void 0) {
+        if (opts.token === void 0) throw new Error("--username requires --token.");
+        body = { authType: "basic", username: opts.username, credential: opts.token };
+      } else if (opts.token !== void 0) {
+        body = { authType: "token", credential: opts.token };
+      } else {
+        body = { authType: "none" };
+      }
+      if (opts.knownHostsFile !== void 0 && opts.sshKeyFile === void 0) {
+        throw new Error("--known-hosts-file requires --ssh-key-file.");
+      }
+      const result = await (await client(opts)).post("/api/v1/actions/repos", {
+        cloneUrl,
+        ...body,
+        ...opts.name !== void 0 && { name: opts.name },
+        ...opts.branch !== void 0 && { defaultBranch: opts.branch }
+      });
+      output(opts, result, (r) => {
+        console.log(`connected  ${pc.cyan(safeTerm(r.fullName))}  ${pc.dim(`(${safeTerm(r.authType)}, ${safeTerm(r.defaultBranch)})`)}`);
+        printDiscovery(r.discovery);
+      });
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  common(
+    repos.command("enable").description("Enable a repo the org can already see (granted by a GitHub App install, or a connected remote)").argument("<repo>", "repository in owner/repo format").option("--repo-id <id>", "scope to one row when two installations grant the same name")
+  ).action(async (repo, opts) => {
+    try {
+      const result = await (await client(opts)).patch("/api/v1/actions/repos", {
+        fullName: repo,
+        enabled: true,
+        ...opts.repoId !== void 0 && { repoId: opts.repoId }
+      });
+      output(opts, result, (r) => {
+        console.log(`enabled  ${pc.cyan(safeTerm(r.fullName))}`);
+        if (r.discovery) printDiscovery(r.discovery);
+      });
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  common(
+    repos.command("disable").description("Disable a repo \u2014 it stays connected but no runs are scheduled").argument("<repo>", "repository in owner/repo format").option("--repo-id <id>", "scope to one row when two installations grant the same name")
+  ).action(async (repo, opts) => {
+    try {
+      const result = await (await client(opts)).patch("/api/v1/actions/repos", {
+        fullName: repo,
+        enabled: false,
+        ...opts.repoId !== void 0 && { repoId: opts.repoId }
+      });
+      output(opts, result, (r) => console.log(`disabled  ${pc.cyan(safeTerm(r.fullName))}`));
+    } catch (e) {
+      fail(e, opts);
     }
   });
   common(
     actions.command("cancel").description("Cancel a run").argument("<run-id>", "run ID")
   ).action(async (runId, opts) => {
     try {
-      const result = await client(opts).post(
+      const result = await (await client(opts)).post(
         `/api/v1/actions/runs/${runId}/cancel`
       );
       output(opts, result, (r) => {
         console.log(r.cancelled ? `Cancelled ${runId}` : `Run ${runId} was already finished`);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("rerun").description("Re-run a finished run at the same commit").argument("<run-id>", "run ID")
   ).action(async (runId, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       const result = await c.post(
         `/api/v1/actions/runs/${runId}/rerun`
       );
@@ -1366,14 +1743,14 @@ function registerActionsCommands(program2) {
         console.log(`url: ${r.url}`);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("artifacts").description("List or download a run's artifacts").argument("<run-id>", "run ID").option("--job <job>", "job ID or name (default: all jobs)").option("--out <dir>", "download artifacts into this directory instead of listing")
   ).action(async (runId, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       let jobs = await listRunJobs(c, runId);
       if (opts.job) {
         const job = matchJob(jobs, opts.job);
@@ -1422,7 +1799,7 @@ function registerActionsCommands(program2) {
         if (!any) console.log("No artifacts.");
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
 }
@@ -1670,7 +2047,7 @@ init_workspace_cli();
 var __filename2 = fileURLToPath2(import.meta.url);
 var __dirname2 = dirname2(__filename2);
 var packageJson = JSON.parse(
-  readFileSync4(join5(__dirname2, "..", "package.json"), "utf-8")
+  readFileSync5(join5(__dirname2, "..", "package.json"), "utf-8")
 );
 var isDevBuild = import.meta.url.includes("worktrees") || import.meta.url.includes("/packages/cli/");
 var VERSION = isDevBuild ? `${packageJson.version}-dev` : packageJson.version;